21093351d1abfe8c9693188228fd570add6aa01c7c6b673c37ba2e067a7c0411

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
Size 18.7MB
Sample260705-eb7dmacy6q
SHA256 21093351d1abfe8c9693188228fd570add6aa01c7c6b673c37ba2e067a7c0411
MD5 5c7fc336c6327eaf7b7a76f213c11652
SHA1 b1b8a4bbac6c1251110974fc248c92d28b645cfb
SHA512 c8095e97aba64f0cda4a84b243cfc69169f335168cdf422d9af71a8190f4fa8e704afe8827a2e1f03ea77c3e095a4d69f7433298a6db930f7c3570187850602a
SSDEEP 196608:6WyZ/K0ttYVAAT1Kmd0x/h1+FGbSSWyZ/K0ttYVAAT1Kmd0x/h1+FGbTb:VyZ/K0ttYZTEqJyZ/K0ttYZTEqA
TLSH
T19A176B03F2A841E9E06AD178CE669632DB727C4947F1A5EF224076D52F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4676	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276968438437345"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
4176	chrome.exe
4176	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe
Token: SeShutdownPrivilege	2596	chrome.exe
Token: SeCreatePagefilePrivilege	2596	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2596	chrome.exe
2596	chrome.exe
2596	chrome.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 1196	5996	2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	88
PID 5996 wrote to memory of 2596	5996	2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe	89
PID 2596 wrote to memory of 5460	2596	chrome.exe	90
PID 2596 wrote to memory of 2348	2596	chrome.exe	91
PID 2596 wrote to memory of 2348	2596	chrome.exe	91
PID 2596 wrote to memory of 4676	2596	chrome.exe	92
PID 2596 wrote to memory of 1636	2596	chrome.exe	93
PID 2596 wrote to memory of 1636	2596	chrome.exe	93
PID 2596 wrote to memory of 1876	2596	chrome.exe	95
PID 2596 wrote to memory of 1876	2596	chrome.exe	95
PID 2596 wrote to memory of 5888	2596	chrome.exe	96
PID 2596 wrote to memory of 5888	2596	chrome.exe	96
PID 2596 wrote to memory of 4476	2596	chrome.exe	97
PID 2596 wrote to memory of 4476	2596	chrome.exe	97
PID 2596 wrote to memory of 2924	2596	chrome.exe	98
PID 2596 wrote to memory of 2924	2596	chrome.exe	98
PID 2596 wrote to memory of 2460	2596	chrome.exe	115
PID 2596 wrote to memory of 2460	2596	chrome.exe	115
PID 2596 wrote to memory of 3836	2596	chrome.exe	101
PID 2596 wrote to memory of 3836	2596	chrome.exe	101
PID 2596 wrote to memory of 3852	2596	chrome.exe	102
PID 2596 wrote to memory of 2784	2596	chrome.exe	103
PID 2596 wrote to memory of 3340	2596	chrome.exe	104
PID 2596 wrote to memory of 2784	2596	chrome.exe	103
PID 2596 wrote to memory of 3340	2596	chrome.exe	104
PID 2596 wrote to memory of 5800	2596	chrome.exe	105
PID 2596 wrote to memory of 5800	2596	chrome.exe	105
PID 2596 wrote to memory of 5932	2596	chrome.exe	107
PID 2596 wrote to memory of 5932	2596	chrome.exe	107
PID 2596 wrote to memory of 1008	2596	chrome.exe	108
PID 2596 wrote to memory of 1008	2596	chrome.exe	108
PID 2596 wrote to memory of 5816	2596	chrome.exe	109
PID 2596 wrote to memory of 5816	2596	chrome.exe	109
PID 2596 wrote to memory of 4304	2596	chrome.exe	110
PID 2596 wrote to memory of 4304	2596	chrome.exe	110
PID 2596 wrote to memory of 3160	2596	chrome.exe	111
PID 2596 wrote to memory of 3160	2596	chrome.exe	111
PID 2596 wrote to memory of 1584	2596	chrome.exe	112
PID 2596 wrote to memory of 1584	2596	chrome.exe	112
PID 2596 wrote to memory of 4444	2596	chrome.exe	113
PID 2596 wrote to memory of 4444	2596	chrome.exe	113
PID 2596 wrote to memory of 2236	2596	chrome.exe	114
PID 2236 wrote to memory of 2460	2236	chrmstp.exe	115
PID 2236 wrote to memory of 5644	2236	chrmstp.exe	117
PID 5644 wrote to memory of 6132	5644	chrmstp.exe	118
PID 2596 wrote to memory of 568	2596	chrome.exe	120
PID 2596 wrote to memory of 568	2596	chrome.exe	120
PID 2596 wrote to memory of 5124	2596	chrome.exe	121
PID 2596 wrote to memory of 5124	2596	chrome.exe	121
PID 2596 wrote to memory of 2572	2596	chrome.exe	122
PID 2596 wrote to memory of 2572	2596	chrome.exe	122
PID 2596 wrote to memory of 4500	2596	chrome.exe	123
PID 2596 wrote to memory of 4500	2596	chrome.exe	123
PID 2596 wrote to memory of 2140	2596	chrome.exe	124
PID 2596 wrote to memory of 5652	2596	chrome.exe	125
PID 2596 wrote to memory of 2140	2596	chrome.exe	124
PID 2596 wrote to memory of 5652	2596	chrome.exe	125
PID 2596 wrote to memory of 5668	2596	chrome.exe	126
PID 2596 wrote to memory of 5668	2596	chrome.exe	126
PID 2596 wrote to memory of 2000	2596	chrome.exe	128
PID 2596 wrote to memory of 2764	2596	chrome.exe	129
PID 2596 wrote to memory of 1436	2596	chrome.exe	130
PID 2596 wrote to memory of 4176	2596	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c7fc336c6327eaf7b7a76f213c11652_amadey_cobalt-strike_emotet_hijackloader_icedid_njrat_re.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff6a4d2b618,0x7ff6a4d2b628,0x7ff6a4d2b638
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe84c7c728,0x7ffe84c7c734,0x7ffe84c7c740
    3⤵
    PID:5460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,3431126795258544692,2858336470566913388,262144 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:2348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1316,i,1592181288680020049,6942476767265242586,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,16060783483222716251,13677303872377755059,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,11423670043209443870,2406027441736583193,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,17886949151437796145,7568119398491577696,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,8582108268263777822,11909932400326554900,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
    3⤵
    PID:4476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4860,i,9107873461547134417,8623546474379344920,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,16510749151809576027,15212846966653964891,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,10363083061733227765,4598157812187905364,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
    3⤵
    PID:3836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,4064657196455176867,3583728316971002041,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,5755654318173100287,11145963908599450131,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5468,i,1834461451089490614,2163290256866593931,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5520,i,13244441841037173399,7267583274534886743,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5768,i,15504106014135886732,542996590657232908,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6072,i,11113823934527145280,17779143423007541754,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6208,i,18013946476921638035,5313510906414252973,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6276,i,4273216085613892730,14880912280121164342,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6280,i,4118137847295433962,6852515749098313363,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,1764257223764240279,2472321215981306962,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,5396746821865996364,13437073306293258448,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x254,0x29c,0x7ff6e1cd55a0,0x7ff6e1cd55ac,0x7ff6e1cd55b8
      4⤵
      Drops file in Windows directory
      PID:2460
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5644
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6e1cd55a0,0x7ff6e1cd55ac,0x7ff6e1cd55b8
        5⤵
        Drops file in Windows directory
        
        PID:6132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,12396065810013141571,9343403589054780214,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
    3⤵
    PID:568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,18246265627208490464,13559989267832422501,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:5124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,10086608034508791558,15582442683034385296,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,5452971583263523542,277155177361298497,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
    3⤵
    PID:4500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5524,i,12119028981290672469,7709828968520396196,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5920,i,8189078706497182406,9751054612797371395,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:9
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6240,i,17043966081664434407,9933409021060362305,2097152 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:9
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,5521856037890113673,9489240710478492249,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,16121188206336081310,15866067073329617929,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
    3⤵
    PID:2764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,2654837666636051066,13094583021862845104,524288 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
    3⤵
    PID:1436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4676,i,295121140463273811,13322917731922867354,262144 --field-trial-handle=1924,i,2929178130113475603,11532653205356482210,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2236_13427696844090393.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2236_13427696844090393.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5644_13427696844060781.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5644_13427696844060781.pma
Size 696B
SHA256 618d7642aa7b77889f268ee54be60dfe9df6636fe084a63c55dd482962ecfaf7
MD5 23757008daccd374b82012d1161c007c
SHA1 82af2f5a923174d92f3b2baae77998c86b67d993
SHA512 6ec791fff02a0f3a097ee791e25a107d9d4b31920a775a028b676b8c133450dd31c22e6e23aa386d1305562659110a7dbc97ca533f8d36526828b71ffd913e6a
TLSH
T143010E46B3584F77CC468D3984FE27512BB4FE602B821BBF7B10764F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f6348165b88c80a43fa7320cfaa76120e2db51c3a8258b366f83feee6f64ee93
MD5 6e5fcd50a4af495cce3115f759901ef3
SHA1 8652f21f5aee6a6c229c41881e93e524571d49c0
SHA512 3b4ae0a6cea4a5cbdcbba6d4a3e7d099994595c7eb90673e1c2559f9cc8e7050b83a09567433d1a62999bd13a277a8f7b9c2cb7e8f166e6dbd9753c6601c061a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\service_worker_bin_prod.js
Size 129KB
SHA256 5de9e74058524e92c88ecfc5e25dee0f3d9f8af92179b33eb52638eb98022965
MD5 a884d818bbadad175baf9bee571fa66e
SHA1 d5d657d1fc86188857246cfb43e28d9e81b55c8c
SHA512 89225dd0b9e62cebc85fc66c80b3c2c4c1315ad47c2be08e1bd94058bec2d6988a96d03e2a09581d3fa7e1146d9d6050d10b117edf3aebf53f8da8c9c9331d5a
SSDEEP 3072:VkbKlHeCWDKPB/UrdJqdwgJSLIH6BTylEeRetlUGo:+oqAB6gbH6BTyGeYt6Go
TLSH
T15ED3D9CDB7A574224363A5F5002F000BB23AB8AAE44C85A8F188D9E97DB546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ffe186243348b93fc58f0cf97bd5969c251593aec8997439f9a3cf3fe40f94a4
MD5 1035a7b271b9cad04d7eb986e75d8265
SHA1 7566ed908ef1ce5290e76d69890cb21a0b22fadb
SHA512 265315212065c6e91b5ab90ee9118906ba6ab54283c406fbfe803f21d823b6ad85a44df51beb3d6640e956a66d27c8e541e3df6e2b9a970ebdedb30d6f4309b0
TLSH
T1B3617EB7D7D8866D892156E49B216E1FCD2E0A64522C3C66C8E4FF5B53E1472D31034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 059b07759b9d408217daae85db15f0a0a8af95f7ea09f96bb6f5663e3c57e08e
MD5 28d402be7bbe0140dafc873800f0b1d8
SHA1 30c855ba90fe8b0b46a3e9e23fbc93beaa91a3ed
SHA512 c956c4695904c377dabd83f3bb2a0eeb127cc52fcf0dde0f1f23ac22513a305f68256e46d77f28efe8cd284c18bd3081399da703ff8f2e4740b2c304023ff730
SSDEEP 192:YRZk5SI3TY9YsYnYEQYpYzYoYTY4Y8Y44QYn/v7r5pAPRp2TXsb+WNnt92qRenii:YRZk42QnofQYWPS/7V4QSX35UXgXwv2j
TLSH
T1FC32C76EAE51A5BB5CCBD329FE25B647D3F6102231D41D40E6FC862C22D79CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e177c8bd787e066e3dedc6f1b22ac7a4d09d65400df1d22ac25d14eea2564147
MD5 74b3aaf40e1fdc4b1546dc34caa5efc7
SHA1 4c50a7ed329b30792fa0b86e3013733207c4dab3
SHA512 113f99e0b805a5803b8561e42451569b7e9d7c040f4c219e0f6b52b26bf8722ca3e8aa9240720c2d1ce8ceffe42cf59f3568607ddced71c90dce998126b5666b
SSDEEP 192:YRZkESI3TY9YsYnYEQYpYzYoYTY4Y8Y44QYn/v7r5poPRpjTXsb+WNnt92rRe8io:YRZkj2QnofQYWPS/7V4QSX35oXnXwv2H
TLSH
T17232D96EA951A5BB5CCBD329FA25BB5BD3F5102231D41D40E6FC862C23D79CC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d3e5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58d3e5.TMP
Size 3KB
SHA256 c835e543ae7f7dfe4f22cb1ca2db45931e8f260ce44ea775e1b912bc71e26608
MD5 0d4474776363f1591f14d2bb50f2ef9b
SHA1 3f23f73624df5851754b58ea0e9dbb5df771b5b7
SHA512 65a26a34ce1716c05281bd8695d8f99862862c5e87050cf3cba5a905a076e627f5ef831a0244f9516b657709df6ef9c0e6388d2468af1f258f6931caa962a783
TLSH
T1416133ADD4B48CA75CB56731B8391BC2FA51533B1140980A3EBE15CC0FB386B8081F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 12fc2899814d7ad8227c3cc5d9a93f508013977bd1f16b4d527a1dbeb65ad1ce
MD5 1e6e20e514a1eb02119ab50a5db11438
SHA1 25973d370bb8b057a15b165ad9d7362b83f2fc42
SHA512 2df3060cfa5e71308eceb256567a2089f96569efcf962bceb563ef0b8afd4294976f9337698835bd8d24eaf00378120448812a700175722dca0601b446968e8d
SSDEEP 384:s+jyF7KxkXqKf/pUZNCgVLH2Hfgsli/7pLuLcWaW3XODyF+ErU3HOHGNsgHgExnR:sOyF7KxkXqKf/pUZNCgVLH2HfgsI/7pj
TLSH
T1F872F8776C4C9A7B0F94CACCDC167E4FACB5024B65E9C86846FA582903D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7c0de86b1a1e64b31656307425ba5bd3332a04bcac8180709f8b27fb912da2f7
MD5 d431b9022b7dd458a682a75192b50e79
SHA1 b5b42b85b86242f39fcdea446bce27dcec2c2b56
SHA512 7598b985f80d525f21790ee86928b9a147c97c6bf8fa20fa4765594ca07b7e578bb48d096b584e57fef5b77292a8789aaf09b979e7ce0930c934cba94756b706
TLSH
T12FB0120CA14E2F41CD4046712549304A32175F3194205707D3E059C58CD32F04297114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 df875a69c90d7365292ece45ea3c5baa8d196a82ab55ad0064d84ce2883176ae
MD5 0b10ea2fa3aaf4980310835426bdf6d7
SHA1 17e862869c2d97516b9fbb48a22d663cb3bf6fbe
SHA512 30ce81a7ab36c8456d28f447cf23e2c57ab0243e6412464061cb1b2f2fff0463ac6a34bc85a95522926b7425e9dfd227dd95a57d09f664cfc5207e4494f95c9d
TLSH
T13BA0025941C018D1CD30A2B070712547F2518A1C5BD5C30365A5188C8C5F2D84501662
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c87.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe591c87.TMP
Size 48B
SHA256 4a3888ca17cb403ad5b161ea97875efca5763705ae7b561733969e2d2f1c20a7
MD5 cfdbf88762e681bbedd987775f5df7d6
SHA1 b58f3ec2f696764c991f4c9c934791fb2f1d55c1
SHA512 157e7f4d3e8b4b63fa0311ff086ce942989b10816fcbf5ca12966a41d9ec21b04f0857d99c6cc5386c337f255b13abf1fef45d2c1afd1d7a4a369868e589ed91
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 ec9e243a76d6033e7f8e8f5b0c38f667e82e375ff2f03ff558bd39b60bc33121
MD5 4337c56c5da42c40832a70ebe6532fc9
SHA1 3b039182052cf470fc12ce1b6d04cbb2eca68ecd
SHA512 96e59dc1dda2b346365e62ac4e1c97ebbcadbe1631fdb81fb29d6c72f60791514636db7d69a0ec0bb0dfc5c5dcb510b0ab8ed50ddb51a04072accd8fbfa2d9e2
SSDEEP 3072:AFPsgSGgXJj2z2jFXjHrkhxNS7IERCBiy78:AFPrAJj2CZjrkfonR
TLSH
T16CC31272BC8F11E80A7AFF9120473D13CC95558B4E6A76085F843F0B0475AB62AC6AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 bad5f1bfa1e620beae2fb53725d8e98453849165972550d36ce9989a73f29cb1
MD5 66428d494f900422d8ac3b22b74f8788
SHA1 44cc397ab21d43ae6e8416791edb55c88ad75b40
SHA512 30ea9f5e71c5d6dd797127b483659524f1813d16ddb7f9bb99945e019ef3e73fc2db2dfe5a2c1ca516968ac00642d0db4a1a96d6daaec01ea5cc1b0a45dc49c5
SSDEEP 3072:AZsgSGgXJj2z2jFXjHrkhxNS7IERCBiy78:AZrAJj2CZjrkfonR
TLSH
T14EC31261BDDF11BC0A7EFB6620973C57CC54158A4D6A62044FC43F0B04B5AB23ACA6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8eb9446149337cdf49bbc168629c536be61ef57a131ad1a25f878e7be69fa149
MD5 5c5c12b2766d43201dccb4004810b9c9
SHA1 6a19b640a1bcb70afbb0135f858fe5be2d17dee5
SHA512 41abbc1b17d7813a030908ddf35d7182c2d5b59c2f10a0a2f06da707dec0df312c44f847069a5117644a71ed8de0aa8a48077954b8b58b144c6545ee6191f51f
SSDEEP 96:rC6Td+xHjVupEnr/FmK9f9NIzYRDotok5KpzDHB69GyvGl45Cabgv4a:rC0K2WTcMN1DUDoHhhf45CabK
TLSH
T181A10736607A997718B6C989B5423A53CE78619BB961AFC8ECE91F0C16FB1F80301537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 769023082e5ff695e8d0794eb7cc845e90c61abefed93890d88d467b7396228d
MD5 ff16744f030f4b17ad316eec1a8fabc9
SHA1 4b75f642638f1e0408e2c052004097e077917bd0
SHA512 d9d466ef096ca48c205cc31b561c7bd1a80b6b0fcdeb32d7e8f8984185949bdf48ceddf9c7286c0e627fce641248a9f152c3a47d4ecdf638283930dca5eced0b
SSDEEP 96:vC6Td+xHjVupEnr/FmK9f9NKznSl8h4otop5KpaDHB6KGyvGm3M/uBnp434p5v0L:vC0K2WTcMNaiU2oches3M/uBnp+4p5vO
TLSH
T1A9C10872A46ED8B758F6D545F5073A9BCE78319B6950AF88EDE60F0C02E70E81346137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2596_2140703432\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 28d8a8dab16464075979f9f73aad95e0c00a36cfb2d21e76a438f184527c0e64
MD5 145c716718f7100f830dd69a8f6bf463
SHA1 a0d4aceced26b297dd415d32115ed6339ba1f1ce
SHA512 53a5d9f6290bf2b9ec2c8e59242f514b9842b994fef58eae2263e2fb41f0afaf06291d608464ded0cd25e1140c6e4cc1ad5189ec7d13b5c7261f252f73fbb346
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 4f8bb67742f27c91bcb90c5d256fc9d030abfd90b9261991ee8e3ca1195bc07e
MD5 43ee938d849a3059842167b4581fca3f
SHA1 a7f101890a45adf23bcc3fa5c97bd883e39edea9
SHA512 29f53a5ac2eb5598d5537c5f0432b05e78ccbca5f827b6c4dff91b15dacf73e712f7bcf2f5cd44b5b59daa172637b3f70b72b54d003fa83f6cc1faea7c42f5a4
SSDEEP 96:TaiOF4OxVQ3AyqFhK2JK2kuXd7DVjY583CBKshK3dK3Ys0:u7F4UQOrCuHw8AGVB
TLSH
T13ED19D968F0349EF3BC18B6B32433152AEAB184AC7D4957277EB8601B0CE964011F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download